How We Automated Enterprise Browser Onboarding with a Slack Bot

The problem we kept running into

Every day, multiple Netskope employees would post in our internal #customerzero Slack channel asking for Enterprise Browser (EB) access. The messages were nearly identical: someone had just heard about EB, wanted to try it out, and needed a license key or enrollment invite to get started.

The CZ team would then manually look up the user, send an enrollment invite through the Netskope admin console, and reply in the thread. This worked, but it was repetitive, manual work that pulled our team away from higher-value investigations and dogfooding activities.

We started asking ourselves: why are we the bottleneck here? The process was entirely mechanical — receive request, identify user, send invite, confirm. It was a perfect candidate for automation.

What we built

We built a Slack bot — CZ Bot — that automatically detects Enterprise Browser invite requests in #customerzero, pulls the requesting user's email from their Slack profile, and calls the Netskope EB enrollment API to send the invite. The entire flow takes under 5 seconds from message to confirmation.

How it works — user experience

From the user's perspective, the experience is simple. They post a message in #customerzero mentioning they need an Enterprise Browser invite or license key. Within seconds, CZ Bot replies in the thread confirming the invite has been sent to their Netskope email address.

They don't need to open a ticket, DM anyone, or wait for business hours. The bot handles it instantly, 24/7.

Example interaction:

The tech behind it

We built this using a combination of Slack's Events API, Tines (our security automation platform), and the Netskope Enterprise Browser enrollment API. Here's the architecture at a high level:

Edge cases we handled

Building this taught us a few things about real-world Slack automation:

• Third-party requests: Sometimes users ask for an invite on behalf of a colleague (e.g. 'can you send an EB invite to @Francisco Mena'). We detect @mentions in the message and send the invite to the mentioned user's email instead of the sender's.
• Bot loop prevention: Without filtering, the bot would respond to its own replies, creating an infinite loop. We added a bot_id null check to ignore all bot-generated messages.
• Thread reply filtering: The bot only responds to top-level channel messages, not replies within existing threads.
• API failure fallback: If the Netskope enrollment API call fails, the bot posts a fallback message tagging the CZ team to handle it manually.
• Private channels: We extended the bot to work in private Slack channels by adding the groups:history and message.groups scopes.

What's next

This is just the first automation in what we're building out as a broader CZ support bot. The next phase will add a generic triage response for all other NS Client issues — prompting users to share their OS version, NS Client version, and screenshots to help the team investigate faster.

We're also exploring extending this pattern to other repetitive request types in the channel. If you're a Netskope customer interested in replicating this for your own internal support channels, reach out to your Netskope account team — we're happy to share the implementation details.

HIGH-LEVEL LOGIC

CZ Bot — EB Invite Automation

Architecture & flow reference for internal and customer documentation

System architecture

The bot uses a two-tier Tines architecture to bridge the public internet (Slack) with Netskope's internal on-prem systems:

Step-by-step flow

Key decision points

Netskope EB Enrollment API

The bot uses the following API call to send enrollment invites:

POST https://<tenant>.goskope.com/api/v2/nsbrowser/invite



Headers:

  Authorization: Bearer <token>

  Content-Type: application/json



Body:

  {

    "invitation": {

      "userIds": ["user@netskope.com"]

    },

    "sendInvitationEmail": true,

    "emailTemplate": 0

  }

Scopes and permissions required